<?php
    $output = '';
    set_include_path('../common/');

    require_once 'IDS/Monitor.php';
    require_once 'IDS/Filter/Storage.php';
    try {

        $storage = new IDS_Filter_Storage();
        $storage->getFilterFromXML('../common/IDS/default_filter.xml');
        $request = array_merge($_GET, $_POST);

        $request['IDS_QUERY_STRING'] = urldecode($_SERVER['QUERY_STRING']);                      
        $request['IDS_USER_AGENT'] = $_SERVER['HTTP_USER_AGENT'];
        $request['IDS_SERVER_ADDR'] = $_SERVER['SERVER_ADDR']; 

        $request = new IDS_Monitor($request, $storage);
        $report = $request->run();

        if(!$report->isEmpty()){
            
            foreach ($report as $event) {
                $output .= '<div class="result"><h3>found injection';                               
                if(!isset($_REQUEST['mini'])){
                    $output .= ': '.substr(htmlentities(stripslashes($event->getValue())),0,120);
                }
                $output .= '</h3></div>';
                foreach($event as $filter){
                    if(strlen($filter->getRule()) > 80){
                        $dots = '...';
                    } else {
                        $dots = null;
                    }
                    $output .= '<div class="result">';
                    if(!isset($_REQUEST['mini'])){
                        $output .= 'rule: '.htmlentities(substr($filter->getRule(),0,80)).$dots.'<br />';
                    }                    
                    $output .= 'rule-description: <i>'.htmlentities($filter->getDescription()).'</i><br />impact: ';
                    $output .= $filter->getImpact().'</div>';
                }
            }

            $output .= '<div class="result"><h3>Overall impact: <strong style="color:red;">'.$report->getImpact().'</strong></h3></div>';
        } else {
            if(!empty($_REQUEST['test'])){
                $output .= '<h3 class="clean">nothing found!</h3>';
            }
        }
        if (!$report->isEmpty()) {
            //$compositeLog->execute($result);
        } else {
            if(!empty($_REQUEST['test'])){
                $output .= '<table id="clean"><tr>';
                $output .= '<td><strong>HTML injection</strong></td><td>'.stripslashes($_REQUEST['test']).'</td>';
                $output .= '</tr><tr>';
                $output .= '<td><strong>a href and onclick doublequoted</strong></td><td><a onclick="';
                $output .= stripslashes($_REQUEST['test']).'" href="?test='.stripslashes($_REQUEST['test']).'">click</a></td>';
                $output .= '</tr><tr>';
                $output .= '<td><strong>a href and onclick singlequoted</strong></td><td><a onclick=\'';
                $output .= stripslashes($_REQUEST['test']).'\' href=\'?test='.stripslashes($_REQUEST['test']).'\'>click</a></td>';
                $output .= '</tr><tr>';
                $output .= '<td><strong>a href and onlclick no quotes</strong></td><td><a onclick=';
                $output .= stripslashes($_REQUEST['test']).' href=?test='.stripslashes($_REQUEST['test']).'>click</a></td>';
                $output .= '</tr><tr>';
                $output .= '<td><strong>script tags</strong></td><td><script>'.stripslashes($_REQUEST['test']).'</script></td>';
                $output .= '</tr></table>';
            }
        }
    } catch (Exception $e) {
    }
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-us">
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <meta name="verify-v1" content="8dsUhRvoVe2a/t95j/cUesQNcTWH4eBn0JKcy8VDCnM=" />
        <title>PHPIDS &raquo; Smoketest</title>
        <link rel="Stylesheet" type="text/css" href="style.css" />
        <?php if(isset($_REQUEST['mini'])){ ?>
            <link rel="Stylesheet" type="text/css" href="style.mini.css" />    
        <?php } ?>
    </head>
    <body>
        <div id="page">
            <h1>
                <a href="http://demo.php-ids.org/">PHPIDS &raquo; Smoketest</a>
            </h1>
            <?php if(!isset($_REQUEST['mini'])){ ?>
            <ul>
                <li class="pagenav">
                    <h2>Pages</h2>
                    <ul>
                        <li class="page-item"><a href="http://php-ids.org" title="Index">Index</a></li>
                        <li class="page-item"><a href="http://php-ids.org/news/" title="News">News</a></li>
                        <li class="page-item"><a href="http://php-ids.org/downloads/" title="Downloads">Downloads</a></li>
                        <li class="page-item"><a href="http://php-ids.org/faq/" title="FAQ">FAQ</a></li>
                        <li class="page-item"><a href="http://php-ids.org/forum/" title="Forum">Forum</a></li>
                        <li class="page-item current_page-item"><a href="http://php-ids.org/demo/" title="Demo">Demo</a></li>
                        <li class="page-item"><a href="http://php-ids.org/trac/" title="Trac">Trac</a></li>
                        <li class="page-item"><a href="http://php-ids.org/contact/" title="Contact">Contact</a></li>
                    </ul>
                </li>
            </ul>  
            <?php } ?>

            <div id="content">
                <?php if(!isset($_REQUEST['mini'])){ ?>                
                <h2>Smoketest</h2>
                <div class="text">
                    Please feel free to inject malicious input to stress test the PHPIDS - you can 
                    either do this via the form or via the $_GET parameter 
                    "<a href="http://demo.php-ids.org/?test=%22%3EXXX">test</a>"
                </div>
                <div class="text">
                    Input not considered malicious by the PHP IDS will be displayed unfiltered - 
                    input considered malicious will be displayed sanitized (So anything malicious not detected by the PHPIDS will be executed).
                </div>
                <div class="text">
                    If you manage to inject an XSS without being noticed by the PHPIDS please 
                    contact us via the <a href="http://groups.google.de/group/php-ids" target="_blank">PHPIDS Google Group</a> and 
                    help us to improve this software! Any other comments and opinions are also highly appreciated.
                    <br /><br />Greetings and thx in advance,<br />the PHPIDS team
                </div>
                <?php } ?>
                
                <?php echo $output; ?>

                <?php if(!isset($_REQUEST['mini'])){ ?>
                <div>
                    <form action="/" method="post">
                        <fieldset>
                            <textarea name="test" rows="6" cols="60"><?php echo htmlentities(utf8_decode(stripslashes($_REQUEST['test']))); ?></textarea>
                            <input type="submit" value="Send" />
                        </fieldset>
                    </form>
                </div>
                <?php } else { ?>
                <div>
                    <form action="/" method="post">
                        <fieldset>
                            <textarea name="test" rows="6" cols="60"><?php echo htmlentities(utf8_decode(stripslashes($_REQUEST['test']))); ?></textarea>                   
                            <input type="hidden" name="mini" />
                            <input type="submit" value="Send" />
                        </fieldset>
                    </form>
                </div>
                <?php } ?>
            </div>
            <?php if(!isset($_REQUEST['mini'])){ ?>
            <div id="sidebar">
                <div id="selfpromotion">
                    <h2>Found a false positive?</h2>
                    <p>
                        Please submit the string to help us make the PHPIDS better. 
                    </p>
                    <div>
                        <script src="http://dabbledb.com/js/api.js" type="text/javascript"></script>
                        <script src="http://xssdb.dabbledb.com/schema/falsealertsdb/533397090" type="text/javascript"></script>
                        <form class="dabble-form">
                            <table>
                                <tr>
                                    <td>
                                        <script type="text/javascript">Dabble.field(1999).writeInput()</script>
                                    </td>
                                </tr>
                                <tr>
                                    <td>
                                        <script type="text/javascript">Dabble.writeSubmit('Submit');</script>
                                    </td>
                                </tr>
                            </table>
                        </form>
                    </div>
                    <h2>Related stuff</h2>
                    <ul>
                        <li>
                            <a href="http://groups.google.de/group/php-ids/">PHPIDS Google Group</a>
                        </li>
                        <li>
                            <a href="http://h4k.in/encoding">PHP charset encoder</a>
                        </li>
                        <li>
                            <a href="http://h4k.in/dataurl">data: URL testcases</a>
                        </li>
                        <li>
                            <a href="http://sla.ckers.org/forum/read.php?12,8085">sla.ckers.org PHP IDS thread</a>
                        </li>                        
                    </ul>
                </div>
            </div>
            <div id="footer">
                <p>
                    &copy; <?php echo date('Y'); ?> - PHPIDS Group
                    <br />
                    hosted by <a href="http://schokokeks.org/">schokokeks.org</a>
                    &bull;
                    supported by <a href="https://ormigo.com/">ormigo.com</a> &amp; <a href="http://neu.de/">neu.de</a>
                    &bull;
                    <a href="http://sla.ckers.org/">sla.ckers.org</a>
                    &bull;
                    <a href="http://planet-websecurity.org/">planet-websecurity.org</a>
                </p>
            </div>  
            <?php } else { ?>
                <div style="clear:both;"></div>
            <?php } ?>          
        </div>
        
        <script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
        </script>
        <script type="text/javascript">
        _uacct = "UA-82607-8";
        urchinTracker();
        </script>
    </body>
</html>